Critical-risk tools in Rebillia MCP Server
24 of the 105 tools in Rebillia MCP Server are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
delete_currencyDestructiveDelete a company currency. DELETE /currencies/{companyCurrencyId}. Fails if currency is in use (invoices, subscriptions, transactions, or gateways).
-
delete_customerDestructiveDelete a customer by ID. DELETE /customers/{customerId}. WARNING: Cascading delete may remove or orphan related data (addresses, payment methods, subscriptions, invoices, etc.)....
-
delete_customer_addressDestructiveDelete an address book entry. DELETE /customers/{customerId}/addressbooks/{addressId}.
-
delete_customer_charge_creditDestructiveDelete a charge or credit for a customer. DELETE /customers/{customerId}/charges_credits/{chargeCreditId}. Fails if the charge/credit has invoice details assigned.
-
delete_customer_payment_methodDestructiveDelete a payment method. DELETE /customers/{customerId}/paymentmethods/{paymentMethodId}.
-
delete_gatewayDestructiveDelete a company gateway. DELETE /gateways/{gatewayId}. Fails if gateway is linked to company currencies or customers.
-
delete_invoiceDestructiveDelete an invoice. DELETE /invoices/{invoiceId}.
-
delete_productDestructiveDelete a product. DELETE /products/{productId}. Warning: This also deletes associated rate plans and related data (cascading deletion).
-
delete_product_rate_planDestructiveDelete a rate plan. DELETE /product-rateplans/{ratePlanId}.
-
delete_product_rate_plan_chargeDestructiveDelete a rate plan charge. DELETE /product-rateplan-charges/{chargeId}.
-
delete_subscriptionDestructiveDelete a subscription. DELETE /subscriptions/{subscriptionId}. Warning: Prefer changing status to archived (update_subscription_status) instead of deleting when you want to end ...
-
remove_filterDestructiveDelete a company filter. DELETE /companies/filters/{filterId}. Required: filterId.
-
remove_subscription_rate_planDestructiveRemove a rate plan from a subscription. DELETE /subscriptions/{subscriptionId}/rateplans/{ratePlanId}.
-
remove_subscription_rate_plan_chargeDestructiveRemove a rate plan charge from a subscription. DELETE /subscriptions/{subscriptionId}/rateplan-charges/{chargeId}.
-
unlink_external_productDestructiveUnlink an external product from a product. DELETE /products/{productId}/external-products/{externalProductId}.
-
void_invoiceDestructiveVoid an invoice. PUT /invoices/{invoiceId}/void. CRITICAL: This action is IRREVERSIBLE. Use with caution.
-
add_subscription_rate_plan_chargeFinancialAdd a rate plan charge to a subscription rate plan. POST .../rateplan-charges. Required: subscriptionId, ratePlanId, quantity, name, category (physical|digital), chargeModel (fl...
-
charge_invoiceFinancialCharge an invoice (card/online payment). POST /invoices/{invoiceId}/charge. AMOUNT IN CENTS: e.g. 5500 = $55.00. Required: invoiceId, amount (integer cents), paymentType (offlin...
-
charge_invoice_externalFinancialCharge an invoice via offline payment (cash/check/wire). POST /invoices/{invoiceId}/charge with paymentType: offlinePaymentProvider. AMOUNT IN CENTS: e.g. 5500 = $55.00. Require...
-
create_customer_charge_creditFinancialCreate a charge or credit for a customer. POST /customers/{customerId}/charges_credits. IMPORTANT: amount is in CENTS (e.g. 10000 = $100.00). Required: amount (integer, in cents...
-
create_setup_intentFinancialCreate or retrieve a setup intent via the gateway endpoint. Use only as part of a gateway-agnostic payment method flow: the returned setupIntent.id can be used as paymentMethodN...
-
create_subscriptionFinancialCreate a subscription from a product rate plan. POST /subscriptions/from-product-rateplan. Required: productRatePlanId, customerId, customerPaymentMethodId, billingAddressId, ef...
-
refund_transactionFinancialRefund a transaction. POST /transactions/{transactionId}/refund. AMOUNT IN CENTS: e.g. 250 = $2.50, 5500 = $55.00. Required: transactionId, amount (integer cents).
-
void_transactionFinancialVoid a transaction. POST /transactions/{transactionId}/void. Only works before settlement; after settlement use refund_transaction instead.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.